diff --git a/apps/nextcloud/manifests/redis-cr.yaml b/apps/nextcloud/manifests/redis-cr.yaml
index 5249d60..cfdd1a3 100644
--- a/apps/nextcloud/manifests/redis-cr.yaml
+++ b/apps/nextcloud/manifests/redis-cr.yaml
@@ -49,6 +49,12 @@ metadata:
   name: redis-nextcloud
   namespace: nextcloud
 spec:
+  # Without this, the redis process can't write to its PVC-backed data dirs
+  # (appendonlydir, node-conf) - "Permission denied", confirmed live 2026-08-17.
+  # 1000 matches the opstree/redis image's default non-root "redis" user.
+  podSecurityContext:
+    fsGroup: 1000
+    runAsUser: 1000
   kubernetesConfig:
     image: quay.io/opstree/redis:v7.0.12
     imagePullPolicy: IfNotPresent